0

Story:

I have my drupal site hosted in aws. Initially there were so many spam registrations occured. I prevented this completely by google recaptcha. By checking the recent logs in drupal I see the registrations comes from 2 ip address repeatedly.

Steps I tried to block IP:

1) Added the code to htaccess:

order allow,deny
deny from ***.**.**.*
deny from ***.**.**.*
allow from all

When i give these 2 ip address in the htaccess, the site shows Forbidden(tried from other systems too). When I give some other ip i am able to access the site.

2) Drupal ip blocking configuration When I give these 2 ip address , it says not a valid ip address. Every other ip address it accepts. Then I tried to add sample ip and changed the ip address from the db table 'blocked_ips', then when I load the site, it says it is blocked.

From the drupal log i could see that the hacker is trying to create spam contents. I need to block their IP address. They have prevented me to do so somehow, thats why the above steps do not work.

Something strange is going on. Any ideas to prevent this. All welcome.

Improve this question
16
  • 192.168.44.201 is a local IP address - it would appear your server and local network are compromised. This isn't something Drupal can help you with, get a professional server admin to audit the machines that are involved
    – Clive ♦
    Commented Nov 16, 2015 at 16:25
  • It might be a bit futile to do this. They'll just get a different IP and spam from there, and you need to block that one, then they get another etc ...
    – Beebee
    Commented Nov 16, 2015 at 16:32
  • I was gonna suggest something like HTTP:BL but your spammers are unknown to these blacklisting databases :( You can always submit them as spammers though! drupal.org/project/httpbl
    – Beebee
    Commented Nov 16, 2015 at 16:34
  • I know if they want they can change ip. But I am sure this can be solved completely. But for now I wanted to atleast block these ip address. It is not able to do even that. May be if they do not know to change ip :P
    – Mirza V U
    Commented Nov 16, 2015 at 16:36
  • 1
    drupal.org/node/1820048 Have you set reverse_proxy to TRUE and have your load balancer IP in $conf['reverse_proxy_addresses'] in your settings.php? If not, you may want to do that first, then you might get totally different (The real) IP's of the attackers. Sounds like your configuration is a little off.
    – Beebee
    Commented Nov 16, 2015 at 16:47

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.